I've had really good luck with vcsh and git-crypt. vcsh can be a little awkward to use because git commands need to be scoped to the vcsh project, but you get used to it. I like having separate git repos for separate roles (e.g., fish-common, fish-personal, fish-work). Then, depending on what I'm doing on a particular machine I can pull in just the roles I need. It may seem like overkill, but I've found it very helpful in sharing my dev config without pulling personal stuff onto a work machine, vice versa.

git-crypt allows me to protect sensitive files while still tracking them in a git repo. I don't think I'd rely on it for shared projects, but it works well for me.